# Preparser.py 
# VHP-2, slawek@rozbicki.eu

from scapy.all import rdpcap
from Pool import Pool as PoolObj

class Parser:
	u"Parser"
	def __init__(self, pcapfile):
		u""
		self.f = pcapfile
		self.buf = rdpcap(pcapfile)
		self.Pool = PoolObj()
        def __repr__(self):
                return u"Parser Class (%s)" % self.f
        def _Filter(self, pkt):
                u"Make sure the packet is interesting"
		try:
			pkt[3]
		except IndexError:
			return ""
                return pkt
        def _Parse(self, pkt):
                u"Parse single packet"
                pkt = self._Filter(pkt)
		if not len(pkt):
			return # Packet discarded by _Filter()
		src_ip = pkt[1].fields['src']
		dst_ip = pkt[1].fields['dst']
		src_port = pkt[2].fields['sport']
		dst_port = pkt[2].fields['dport']
		timestamp = pkt.time
		payload = pkt[3].fields['load']
		payload = self._ParsePayload(payload)
		url, vhost, referrer, user_agent, method = payload
                p = {
		"src_ip" : src_ip,
		"dst_ip" : dst_ip,
		"src_port" : src_port,
		"dst_port" : dst_port,
		"url" : url,
		"vhost" : vhost,
		"referrer" : referrer,
		"user_agent" : user_agent,
		"timestamp" : timestamp,
		"method" : method,
		}
		if p['vhost'] != "": #don't send empty vhost
			self._SendLine(p)
	def _ParsePayload(self, pd):
		u"Process 7th layer of the packet (HTTP content)"
		url = ""
		vhost = ""
		referrer = ""
		user_agent = ""
		method = 0
		pd = pd.replace("\r", "")
		pd = pd.split("\n")
		if pd[0][:4] == "GET ":
			end_offset = pd[0].rfind("HTTP/1")-1
			url = pd[0][4:end_offset]
			method = 0 #its GET
		elif pd[0][:5] == "POST ":
			end_offset = pd[0].rfind("HTTP/1")-1
			url = pd[0][4:end_offset]
			method = 1 #its POST
		for i in range(len(pd)):
			if pd[i][:5] == "Host:":
				vhost = pd[i][6:]
			elif pd[i][:8] == "Referer:":
				referrer = pd[i][9:]
			elif pd[i][:11] == "User-Agent:":
				user_agent = pd[i][12:]
		return url, vhost, referrer, user_agent, method
        def _SendLine(self, packet):
		u"Send table to record pool"
		#p = packet 
		#print "[http://%s%s]    (%s:%d<-%s:%d)" % (p['vhost'], p['url'], p['dst_ip'], p['dst_port'], p['src_ip'], p['src_port'])
		self.Pool.SendLine(packet)
        def Process(self):
                u"Process whole pcap file"
                for i in range(len(self.buf)):
                        p = self.buf[i]
                        self._Parse(p)




